Abstract 
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A method for assembling authorization certificate chains among an 
5 authorizes a client, and a third party allows the client to retain control over third 
party access. The client stores a first certificate from the authorizer providing 
access to a protected resource and delegates some or all of the privileges in the 
first certificate to the third party in a second certificate. The client stores a 
universal resource identifier (URI) associated with both the first certificate and 
10 the third party and provides the second certificate and the URI to the third party. 
The third party requests access to the protected resource by providing the 
second certificate and the URI, without knowledge or possession of the first 
certificate. When the authorizer accesses the URI, the client provides the first 
certificate to the authorizer, so that the client retains control over the third 
15 party's access. 
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